470478183bdb72da323e791740c3bc59dcac2f3b236ade76e587207a41af5b1b

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 23:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-03_f63f7205c1c17fbc0885eb1dd3b3ee73_elex_mafia_stealc_tofsee.exe
Size 384KB
Sample261003-3a5emsga48
SHA256 470478183bdb72da323e791740c3bc59dcac2f3b236ade76e587207a41af5b1b
MD5 f63f7205c1c17fbc0885eb1dd3b3ee73
SHA1 e365fc9e841e806db1a4919daac0fd78f37b0aa5
SHA512 6621e0ce305c8f021e65b80d68f0fc05bd7f27c6e350bc644db2d9ce5e24203585512ee4680ad2c2ceca75db1baa8894006d443c4c09888c1130a2a6638d2de7
SSDEEP 6144:drxfv4co9ZL3GBGgjODxbf7hH4KFrkX0ivHBrYexcWOSpmfRrf0vLw6AQDK2hZ:Zm48gODxbzBkX00rY2cWUf0vLPp5Z
TLSH
T12C84CF247581C037D59701314AFAE766293B3CB68B6468C77BE47BADAE703D1A63430B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
928	B60.tmp

Executes dropped EXE 1 IoCs

pid	Process
928	B60.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-03_f63f7205c1c17fbc0885eb1dd3b3ee73_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B60.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
928	B60.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 928	1196	2026-10-03_f63f7205c1c17fbc0885eb1dd3b3ee73_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-10-03_f63f7205c1c17fbc0885eb1dd3b3ee73_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-03_f63f7205c1c17fbc0885eb1dd3b3ee73_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Users\Admin\AppData\Local\Temp\B60.tmp
  "C:\Users\Admin\AppData\Local\Temp\B60.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-10-03_f63f7205c1c17fbc0885eb1dd3b3ee73_elex_mafia_stealc_tofsee.exe 86C98724A3719929B4F58F50CA3E593F76464C2BA5861F21697BE701DE119E7019D41E97F959CDFB2A4C346DFEB9F91AC1A7F5ADFF761D9F0A3D2681D1AD5425
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

B60.tmp

Path C:\Users\Admin\AppData\Local\Temp\B60.tmp
Size 384KB
SHA256 a456d52c3d120c0eb97a0d428c1a4835bad2b23f6410b93b90950f5ecffa9dc7
MD5 20d3a1759aca0d16ee3467b5dad31856
SHA1 9a2aec66462208413d795d7293aeae4cd0d334a0
SHA512 d30a752311278cfdda00391202772978fa695ce8da5e7eb4ab66c9e039424f77790a48e869eb93dff59c8cb4542ba8e2dca0cbf40e47d3c86e12b05e26c2d732
SSDEEP 6144:drxfv4co9ZL3GBGgjODxbf7hHGRXCXJAg/JfG3qnhhh6W/IdPO5QO21u8jQBseow:Zm48gODxbzGXCAg/JfG3sV6w0P2N0enf
TLSH
T1C184D0347585C036D19B01314AE6E7621A3B7CB64B2568D77BE43B6D9EB03D2AB3430B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download